Suspicious Office/Browser Child Process Execution

Luís Marques@remotecodeexecution

•updated Mar 27, 2026•1•0•92

Detects when a process spawned by Microsoft Office or a web browser executes a child process. These actions can be indicative of malicious activity such as macro-based malware or drive-by downloads.